Bounded security test for personal Herald regexp-pair behavior.
Details
Diff Detail
Event Timeline
Summarization
Intent
The change is related to a security testing effort, specifically a bounded test for personal Herald regexp-pair behavior in Phabricator. This appears to be a test file designed to detect or validate against Regular Expression Denial of Service (ReDoS) vulnerabilities in Phabricator's Herald rule system, which uses regexp matching. The file is part of a "BBP" (Bug Bounty Program) security assessment.
Solution
The solution adds a single test file (bbp-redos-1777050141.txt) containing a crafted input string — a sequence of repeated 'a' characters followed by an 'X' character. This is a classic ReDoS test payload: strings of this pattern are commonly used to trigger catastrophic backtracking in poorly constructed regular expressions. The file serves as a bounded probe to verify that Phabricator's Herald regexp-pair matching handles such adversarial input safely without experiencing exponential-time regex evaluation. No functional code changes are made; this is purely a test artifact for security validation purposes.